PT-2026-64225 · Zenml Io · Zenml-Io/Zenml

CVE-2026-11922 · Published 2026-07-24 · Updated 2026-07-24

NVD

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the POST /api/v1/login and self password-change endpoints by rotating the X-Forwarded-For header. The rate limiter keys requests by request.client.host, which is derived from the X-Forwarded-For header when Uvicorn is launched with --proxy-headers --forwarded-allow-ips *. This configuration allows clients to control the value of request.client.host, effectively bypassing rate-limiting protections. This vulnerability leaves the affected endpoints open to unthrottled credential guessing attacks.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-11922

Affected Products

Zenml-Io/Zenml

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-11922 · Security Note
• https://github.com/zenml-io/zenml/commit/8a2214bdd63eb8200ce4719d82c6f0d935e922d1 · Note
• https://huntr.com/bounties/3cb8bf6a-ae55-4b38-8da3-601c666a210e · Note